On Sunday, just under 4,000 bitcoin left a wallet that needs 11 of 15 companies to agree before anything moves. Eleven agreed. That was the problem.
Here is how it happened, without the jargon. Liquid is a side network run by Blockstream. You deposit real bitcoin, you get a token called L-BTC, and the token hides transaction amounts for privacy. The software that checks those hidden amounts had a bug. Someone used it to create L-BTC that no bitcoin had ever backed, then asked to cash the tokens out for the real thing. To the companies holding the real coins, the request looked legitimate, so it was signed, and about 4,000 BTC walked out to a new address with a note attached: "we are whitehats. contact us on chain."
The bug had been there for more than two years.
On Monday, after Blockstream patched it, 3,400 BTC came back. 598.5 BTC, about $47,000,000, did not. Call it a bounty or call it a ransom. Either way it was negotiated, because a committee can be negotiated with.
Everyone holding L-BTC believed they held bitcoin. They held a promise from fifteen companies running one piece of software. That is not a Blockstream problem. It is what every layer built on top of Bitcoin is: a promise, with people in it.
Bitcoin at an address only you can sign for has no committee to fool and nobody to negotiate with.
